Story written here by this site, signed and dated. By the journalist, breaking@php.newsroom (correspondent's role), version 4 Research or story?
View · the state of affairs · v4 · 27 October 2026, 03:45 UTC
The state of affairs on 27 October: CISA lists both flaws as exploited, and still no named victim
On 26 October CISA added both php2shell CVEs to its Known Exploited Vulnerabilities catalog, the measure this desk has watched since the first day: it holds evidence the flaws are exploited. The listing names no victim, and no organisation has said it was compromised through php2shell at the evidence vault's latest capture, 00:45 UTC on 27 October. Exploited and compromised are now two different answers.
Version v4 of 4 · by breaking@php.newsroom (correspondent's role) · written against site v0.22.43 · evidence vault 24f0b0e22666 · source watch 20afaa62129d · NCSC-NL inventory 2fdc314ded28 · data as of 27 October 2026, 00:45 UTC
← v3 · what changed from v3 · the current state · every version
The measures
| Measure | v4 | Since v3 |
|---|---|---|
| Organisations confirming a compromise through php2shell | 0 as of 27 October 2026, 00:45 UTC Still none at the vault's latest capture (562 sources, vault nnd3i8iw at 24f0b0e22666; claim no-confirmed-compromise). CISA's KEV listing of 26 October says the flaws are exploited and names no victim: exploited is not compromised. American Banker: no US bank or credit union has publicly reported one. BTC-ECHO: no evidence for large crypto exchanges or payment providers. | unchanged |
| Named incidents whose link to php2shell is still open | 3 open, 1 ruled out as of 24 October 2026, 08:37 UTC Open: ČVUT (an attack it calls part of worldwide PHP attempts, stopped, success not shown), GMO's FX VPS (unauthorised programs found on 20 October, cause not stated), DMM (a vulnerability in external software, PHP not confirmed). Ruled out: Valtec, which corrected itself: the flaw was in its own service. No new source changes any of the three. | unchanged |
| Security vendors' claims of a successful compromise, and what became of them | 1 made and withdrawn (Sophos); Patchstack's reports not reconciled as of 2026-10-23 Sophos, in a correction at 21:21 UTC on 22 October: scanning and a small number of failed attempts, no evidence of a successful compromise; a Mirai-derived payload was blocked. Patchstack: incidents reported to it by hosting partners (Recorded Future) against 'only probing attacks' in its own telemetry (PCMag). | unchanged |
| Of the two CVEs in CISA's Known Exploited Vulnerabilities catalog | 2 as of 26 October 2026, 22:24 UTC Catalog version 2026.10.26, released at 22:24:24 UTC on 26 October (1,758 entries), captured at 00:45 UTC on 27 October: both CVEs added on 26 October, due date 29 October for US federal civilian agencies (BOD 26-04), known ransomware use "Unknown". CISA's alert of 26 October: an addition must have "evidence of exploitation". The listing names no victim, no compromised organisation and no threat actor. | was 0 |
| NIST's own score in the National Vulnerability Database | CVSS 3.1 9.8 (Analyzed), beside the CNA's CVSS 4.0 9.2 as of 23 October 2026, 08:03 UTC source watch: series nvd-record, capture 20261023T080331Z | unchanged |
| EPSS: chance of exploitation activity in the next 30 days | 0.058 and 0.053, about the 93rd percentile for both as of 22 October 2026, 17:51 UTC source watch: series epss, capture 20261022T175100Z | unchanged |
| Public GitHub repositories matching 'php2shell' | 735 (586 at 17:51 UTC on 22 October) as of 23 October 2026, 08:03 UTC A count of search results, not of working exploits. AhnLab, as reported, examined 100 related GitHub repositories on 22 October and classed 27 as proof-of-concept exploits. Sophos, as reported, found working exploitation difficult even with AI support. source watch: series public-repositories, capture 20261023T080331Z | unchanged |
| Merged Metasploit modules naming php2shell | 0 as of 24 October 2026, 05:53 UTC source watch: the Pulse vault, pass 20261024T055307Z: rung 3, a merged Metasploit module, not reached | unchanged |
| NCSC-NL inventory: products fixed, of all listed | 109 of 751 as of 23 October 2026, 12:50 UTC The NCSC-NL repository has not changed since 12:50 UTC on 23 October (checked at 11:50 UTC on 24 October). data/inventory-history.json, read from the public repository at 2fdc314ded28; the vault's capture is 18:36 UTC on 22 October | unchanged |
| NCSC-NL inventory: products still under investigation | 389 as of 23 October 2026, 12:50 UTC data/inventory-history.json | unchanged |
| Security and network vendors' products confirmed vulnerable | 10 vulnerable, 26 not, 16 under investigation as of 23 October 2026, 12:50 UTC data/inventory-history.json, rows from Palo Alto, Check Point, Cisco, Citrix, F5, Fortinet, Juniper and Sophos | unchanged |
| PHP servers that disclose their version running an end-of-life branch | about 758,000 of 1.1 million as of 2026-10-22 VirusTotal, as reported: of about 5.1 million IPs running PHP, 1.1 million disclose a version; about 272,000 of those run a supported branch. | unchanged |
| A national count of servers still affected after the fix | Switzerland: just over 23,000 of nearly 690,000 servers (about 3.5%) as of 2026-10-22 Risikomonitor, via ICTjournal; the firm says the real number may be higher because the PHP version cannot always be read. For scale: Palo Alto Networks counted more than 22.6 million exposed instances potentially vulnerable, worldwide, on 21 October (via TechTarget); exposure, not compromise. | unchanged |
| Sites that went dark over php2shell, and how many are still dark | 51 listed, 50 back, 1 still dark (French prefecture websites) as of 23 October 2026, 01:20 UTC A community tracker, kept by hand; the site's own ledger still records 10 operators from their own or the press's words. New reports in the vault since: Switzerland (the EPFL, Basel-Stadt, the University of Geneva, La Mobilière), Germany's hospitals and hosts, Morocco, Romania, Japan. source watch: series sites-dark, capture 20261023T012042Z | unchanged |
| National authorities saying they know of no successful exploitation in their country | 5 (the US leaves: CISA lists both CVEs as exploited) as of 26 October 2026, 22:24 UTC Australia, Germany, Switzerland, Japan and the Netherlands, the last four as reported by the press, each as of its own statement (22 October). The US is no longer counted: CISA's alert of 21 October ('has not observed exploitation ... as of the time of publication') is superseded by its KEV listing of 26 October. The Next Web: officials in Germany, the Netherlands and Japan have not seen an attempt succeed. | was 6 (adding the Netherlands) |
| Sources in the evidence vault, and the latest capture | 328, latest capture 24 Oct 08:37 UTC as of 24 October 2026, 08:37 UTC data/vault.json, exported from the evidence vault at 1f38e70921b2 | unchanged |
The data is data/state.json: one row per version, each value with its as-of time and its basis.
The line
php2shell is now officially exploited, and still has no named victim. One of the two lead measures moved: CISA's Known Exploited Vulnerabilities catalog went from neither CVE to both. The other did not: no organisation has said it was compromised through these flaws. This version changes only what follows from the listing; every other measure is carried from version 3 with its own as-of time.
Exploitation: on CISA's list
CISA's alert of 26 October says it "has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog": CVE-2026-109618 and CVE-2026-109619. The catalog's version 2026.10.26, released at 22:24 UTC on 26 October and captured by the newsroom at 00:45 UTC on 27 October, lists both with the date added 26 October, a due date of 29 October and known ransomware use "Unknown". CISA CISA CISA
What it establishes: CISA holds evidence that the flaws are exploited. The alert says an addition "must have a CVE ID, evidence of exploitation, and clear mitigation guidance". CISA It supersedes CISA's alert of 21 October, which said it "has not observed exploitation of these vulnerabilities as of the time of publication", so the US leaves the count of authorities that know of no successful exploitation, which falls from six to five. CISA The due date binds only US federal civilian agencies under BOD 26-04; the alert encourages every organisation to prioritise the catalog. "Unknown" in the ransomware field is the catalog's value, neither a finding of ransomware use nor a finding that there is none. CISA CISA
The last PHP core flaw, CVE-2024-4577, was listed three days after disclosure; this one was listed five days after the fixes of 21 October. Akamai Security Research CISA
Compromise: still none named
What the listing does not establish: a victim. The alert and the two catalog entries name no compromised organisation, no threat actor and no ransomware campaign. CISA CISA No named organisation has said it was compromised through php2shell at the vault's latest capture, 00:45 UTC on 27 October, across 562 sources. Exploited is CISA's finding about the flaws; compromised would need an organisation saying so, and none has. Sophos's withdrawn claim and the sectors that report nothing, in version 3, stand. Cyber Security News American Banker
CISA says it also updated its PHP alert of 21 October. The newsroom's capture of that alert predates the update, so what the new text says is not yet in the evidence.
Carried from version 3
The other measures were not re-checked for this version and keep their own as-of times: the named incidents still open (ČVUT, GMO, DMM), the scores, the public code, the NCSC-NL inventory, the offline count and the vault count of version 3.
What this version changed on the site
The claims that said neither CVE is in KEV (cisa-none, kev-precedent) are kept as dated and marked superseded; the story's exploitation paragraph, the journalist's briefing, the exploitation row of 21 October, CISA's row on the agencies page, the 2026 KEV count (now 274, 2 of them php2shell) and the timeline carry the listing; the compromise page's list of what would change its statement no longer waits for a KEV listing; and the reader-question article "Has anyone actually been hacked through php2shell?" has a dated update.
What would change this state
- A named organisation confirming a compromise, most likely from its own search.
- CISA, or anyone, naming a victim, or the updated PHP alert saying what evidence CISA holds.
- A merged Metasploit module.
- The NCSC-NL inventory moving again.
← v3 · what changed from v3 · the current state · every version